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S^^^^g ^^miendments to the claims 



This listing of claims replaces all prior listings: 




1. 



(Currently amended) A method for real-time measurement of the performance of 



communications on a large area network between a selected server and a plurality of users, based 
upon actual user experience, including: 

(a) accessing a server log having records indicative of routings of actual user 
access to the selected server; 

(b) aggregating records from the server log into a plurality of aggregate slots, each slot 
having at least one time bin which represents an interval of time, based on an aggregation 
method; 

^ (c) performing at least one statistical analysis separately on each time bin of each 



(d) outputting the results of such statistical analysis as an indication of actual access to 
server usage by users; 

(e) determining exit routes from each selected server based on the records from the server 

log; 

(f) determining a best performing exit route based on the statistical analysis of records 
from the server log; 

( g) biasing incoming and outgoing communications with respect to each server to use the 
determined best performing exit route; 

(h) defining a database comprising large area network address blocks having 
geographical or source information; 

(0 comparing an address field in each record to the address blocks in the database; 
(0 associating with each record the geographical or source information from an address 
block matching the address field of the record, including 




aggregate slot; a»d 
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(10 defining an array of binary trees for the address blocks in the database, each 
address block within a binary tree within an array element being masked by a 
corresponding unique subnet mask value; 

(1) masking each address field in each record by a unique subnet value 
corresponding to a selected array element; 

(m) comparing each masked address field to an address field of the address blocks 
within the binary tree of the selected array element; 

fn) outputting selected fields of any matching address block; and 

(o) otherwise, continuing the step of comparing with a next selected array element 
until a match is found or all array elements have been compared. 

2. (Original) The method of claim 1, further including filtering out selected records from the 
server log before the step of aggregating. 

3. (Original) The method of claim 1, further including generating an event notification if a 
selected statistical analysis value is abnormal. 

4. (Original) The method of claim 1, further including selecting the aggregation method 
from a set of aggregation methods. 

5. (Original) The method of claim 1, wherein the aggregation method includes aggregation 
by log-file record column data value for each record from the server log. 

^6-9. (Canceled) 

10. (Withdrawn) A method for comparing an address field of a large area network record to a 
database comprising large area network address blocks having geographical or source 
information, including: 

(r) defining an array of binary treek for the address blocks in the database, each address 
block within a binary tree within an array e\em£n^being rr^asked by a corresponding unique 
subnet mask value; 

(s) masking the address field of a larg^area network record by a unique subnet value 
corresponding to a selected array element; 

(t) comparing each masked address field an address field of the address blocks within 
the binary tree of the selected array element; 
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(u) indicating a match; and 
(v) otherwise, continuing the steV ofVcprfiparing with a next selected array element until a 
^ match is found or all array elements have^been compared. 

X~yt. (Currently amended) A system for real-time measurement of the performance of 

communications on a large area network between a selected server and a plurality of users, based 
upon actual user experience, including: 

(w) a server log having records with data indicative of routings of actual user access to 
the selected server; 

(x) means for accessing and aggregating records from the server log into a plurality of 
aggregate slots, each having at least one time bin which represents an interval of time, based on 
an aggregation method; 

(y) means for performing at least one statistical analysis of each time being of each 
aggregate slot; and 

(z) means for outputting the results of such statistical analysis as an indication of access 
to actual server usage by users; 

(aa) means for determining exit routes from each selected server based on the records 
from the server log; 

(bb) means for determining a best performing exit route based on the statistical analysis 
of records from the server log; 

(cc) means for biasing incoming and outgoing communications with respect to each 
server to use the determined best performing exit route; 

fdd) means for determining geographical or source information for each record; and 

(ee) means for selecting the aggregation method to aggregate records based on such 
geographical or source information, including 

(ff) a database for comprising large area network address blocks having 

geographical or source information; 

(gg) a comparison function for comparing an address field in each record to the 

address blocks in the database; and 
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(hh) an associating function for associating with each record the geographical or 
source information from an address block matching the address field of the record, 
including 

(ip an array of binary trees from the address blocks in the database, each 
address block within a binary tree within an array element being masked by a 
corresponding unique subnet mask value; 

(ii) means for masking each address field in each record by a unique 
subnet value corresponding to a selected array element; 

fkk) means for outputting selected fields of any matching address block; 

and 

(ID means for otherwise continuing the step of comparing with a next 
selected array element until a match is found or all array elements have been 
^ compared . ^ 

X^. (Previously presented) The system of claim y(, further including means for filtering out 

selected records from the server log before the step of aggregating. 

(Original) The system of claim jrt^ further including means for generating an event 

notification if a selected statistical analysis value is abnormal, 
^j/f. (Original) The system of claim yl, further including means for selecting the aggregation 

method from a set of aggregation method^. 
^?>. (Original) The system of claim wherein the aggregation method includes aggregation 

by log-file record column data value for each record from the server log. 

16-19. (canceled) 

20. (Withdrawn) A system for comparing an address field of a large area network record to a 
database comprising large area network ^ddresS^SJocks^iaving geographical or source 
information, including: 

(nn) an array of binary trees for the Address hjtfcks in the database, each address block 
within a binary tree within an array element cueing masked by a corresponding unique subnet 
mask value; 
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(oo) means for masking thaaddress field of a large area network record by a unique 
subnet value corresponding to a selected array element; 

(pp) means for comparing each maraed adtiress field to an address field of the address 
blocks within the binary tree of the selected array element; 

(qq) means for indicating a match; ana 

(rr) means for otherwise continuing the step of comparing with a next selected array 



element until a match is found or all array elements have been compared. 



J 

34. (Currently amended) A computer program, stored on a computer-readable medium, for 
real-time measurement of the performance of communications on a large area network between a 
selected server and a plurality of users, based upon actual user experience, the computer program 
comprising instructions for causing a computer system to: 

(ss) access a server log having records of routing of actual user access to the selected 

server; 

(tt) aggregate records from the server log into a plurality of aggregate slots, each having 
at least one time bin, based on an aggregation method; 

(uu) perform at least one statistical analysis of each time bin, representing a time interval, 
of each aggregate slot; an4 

(vv) output the results of each statistical analysis as an indication of actual server usage 
by users; 

fww) determine exit routes from each selected server based on the records from the 
server log; 

(xx) determine a best performing exit route based on the statistical analysis of records 
from the server log; 

(yy) bias incoming and outgoing communications with respect to each server to use the 
determined best performing exit route; 

(zz) determine geographical or source information for each record; and 

(aaa) select the aggregation method to aggregate records based on such geographical 

source information, including 
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(bbtv) define a database comprising large area network address blocks having; 
geographical or source information; 

(ccc) compare and address field in each record to the address blocks in the 
database; and 

(ddd) associate with each record the geographical or source information from an 
address block matching the address field of the record, including 

(eee) define an array of binary trees for the address blocks in the database, 
each address block within a binary tree within an array element being masked by 
a corresponding unique subnet mask value; 

ffff) make each address field in each record by a unique subnet value 

corresponding to a selected array element; 

(ggg) compare each masked address field to an address field of the address 
blocks within the binary tree of the selected array element; 
(hhh) output selected fields of any matching address block; and 
(iii) otherwise, continue the step of comparing with a next selected array 
^ element until a match is found or all array elements have been compared . 



(Original) The computer program of claimy^, further including instructions for causing 
the computer system to filter out selected records from the server log before the step of 
^-gating. & 

^fS. (Original) The computer program of claim 24, further including instructions for causing 

the computer system to generate an event notification if a selected statistical analysis value is 
^normal. & 

2f4. (Original) The computer program of claim 24, further including instructions for causing 
^he^computer system to select the aggregation method from a set of aggregation methods. 

^^o. (Original) The computer program of clairr?^ wherein the aggregation method includes 
aggregation by log-file record column data for each record from the server log. 

[26 - 29. (Canceled) 
30. (Withdrawn) A computer program, stored cm a iomputer-readable medium, for 
comparing an address field of a large area network r^ord to a database comprising large area 
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to an address field of the address blocks within 



network address blocks having geographical or source information, the computer program 
comprising instructions for causing a computer system to: 

(jjj) define an array of biliary trees for the address blocks in the database, each address 
block within a binary tree within^ array element being masked by corresponding unique subnet 
mask value; 

(kkk) mask the address fielfl of a large area network record by a unique subnet value 
corresponding to a selected array element; 

(111) compare each masked 
the binary tree of the selected array element; 
(mmm) indicate a match; and 
(nnn) otherwise, continue the stepbf comparing with a next selected array element until a 
match is found or all array elements have Ween compared. 

(Previously presented) A method as in claim 1, wherein said statistical analysis 
determines time for specified user access relative to a specified interval, and sorts said user 
access according to a number of times that the application exceeds said interval. 
/ ^2. (Previously presented) A method as in claim 1, wherein said server log includes a time 

stamp indicating when a record was formed, a client EP address, a time taken to complete 
^jransmission, and a size of the transmission. n 
\jl!>. (Previously presented) A method as in claim 32, wherein said server log is formed by 
adding new data entry to the server log, and said server log is closed to further data entry prior to 
^said performing. 

(Previously presented) A method as in claim ^2, wherein said aggregating comprises 



determining a geographic location from the IP address, and aggregating IP addresses having a 
^pecified relationship with a specified geographical location. 

^ ifs. (Previously presented) A method as in claim further comprising aggregating said time 
t^ins into chronological order and determining trends^mong said time bins. 

l A (Previously presented) A method as in claim ^, further comprising using said 
information to computer byte density, transfer fate, and error fraction. 
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37. (Previously presented) A method as in claim ^2, wherein said statistical analysis is an 

assessment of performance related measurement against a geographical location of a client. 

(Previously presented) A method as in claim 32, wherein said statistical analysis is an 

assessment of a route traversed during use of the network application by an end user. 
^2^. (Previously presented) A method as in claim 1, further comprising determining a new 

path based on said results of said statistical analysis. ^ 
typ. (Previously presented) A system as in claim jR, wherein said server log includes a time 

stamp indicating when a record was formed, a client IP address, a time taken to complete 

transmission, and a size of the transmission. n 

. (Previously presented) A system as in claim jO, wherein said server log is formed by 

added new data as entries to the server log, and said server log is closed to further data entry 



0 



^prior to said performing. 

(Previously presented) A system as in claim ^( wherein said accessing means converts 
the DP address into a geographical location, and aggregates IP addresses having a specified 
relationship with a specified geographical location, 

(Previously presented) A system as in claim 4$, wherein said statistical analysis is an 
assessment of performance related measurement against a geographical location of a client. 

(Previously presented) A system as in claim 40, wherein said statistical analysis is an 
assessment of a route traversed during use of the network application by an end user, 
^jk. (Previously presented) A system as in claim^, further comprising a communication 
routing part, determining a new path based on said results of said statistical analysis. 
'^6. (Previously presented) The computer program as in clai wherein said instructions to 
access the server log comprises instructions to access a server log that includes time information 
about records, client EP address, time taken to compete a transmission, and a size of the 



transmission. 



\ 



(Previously presented) The computer program as in claim Jf6, wherein said instructions to 
aggregate include instructions to convert the IP address into information indicative of a 
geographical location, and to aggregate the information according to the geographical location. 



5^ 



0 
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"2 fr 

48. (Previously presented) The computer program as in claim 47, wherein said instructions to 
perform a statistical analysis perform a statistical analysis of performance versus geographical 
location of the client. n 

j9. (Previously presented) The computer program as in claim jfl, wherein said instructions to 
perform a statistical analysis perform the a statistical analysis assessing a route traversed during a 
^ network application. ^ 
ijh. (Previously presented) The computer program as in claim £ further comprising 
additional instructions to determine a new path based on results of said statistical analysis. 



